THORChain pauses swaps after block reorg bug, impacting Binance thefts

THORChain halted cross-chain swaps across multiple networks after an Ethereum block reorganization exposed what the protocol described as a refund bug. The issue, which began Saturday at 11:34 UTC, also became part of the broader conversation around efforts to curb the movement of stolen funds from major hacks.

According to Chainalysis, the emergency pause inadvertently slowed attempts to launder cryptocurrency taken in last week’s $6.3 billion Binance attack, as the pause prevented users—including alleged North Korean actors—from routing assets through THORChain’s cross-chain swaps until services returned to normal.

Key takeaways

• THORChain said the incident started at 11:34 UTC on Saturday after an Ethereum one-block reorg removed a previously credited 10 ETH deposit.
• A refund was triggered against funds the vault reportedly had not received, and the resulting over-refund contributed to an automatic pause.
• THORChain warned that once a refund mismatch is publicly known, a malicious actor could potentially exploit future reorg scenarios.
• Chainalysis reported that the halt disrupted cross-chain laundering attempts tied to the $6.3 billion Binance hack.
• Node operators paused swaps on 10 networks (including Bitcoin, Ethereum, Solana, and Tron) while trading continued on Avanchce, Base, and XRP, per the protocol’s status page.

How an Ethereum reorg triggered the refund mismatch

THORChain said the incident began when a one-block reorganization on Ethereum caused a credited deposit to disappear from the canonical chain. The protocol described a sequence in which a one-block reorg removed a 10 ETH deposit that THORChain had already credited, leaving the swap unable to satisfy its price limit conditions.

When the swap failed its price constraint, THORChain issued a refund against funds the vault reportedly had never received. The protocol also stated that the sender’s actual deposit was refunded, producing an additional 10 ETH payout, which then triggered an automatic pause.

An Ethereum block reorganization occurs when the network replaces a recent block with an alternative competing block. In this case, THORChain said the newly surfaced behavior allows the protocol to refund a payment that Ethereum no longer recognizes as having occurred.

“Now that this is public knowledge, every time there is a block re-org on an external chain, a malicious actor could perform a new transaction with the same nonce and would be paid funds by the THORChain vaults,” the protocol’s team said.

Swaps paused on 10 networks; operators decide when to resume

To contain the issue, THORChain node operators paused swaps involving assets on 10 networks. The list included major ecosystems such as Bitcoin, Ethereum, Solana, and Tron. Meanwhile, trading continued on Avalanche, Base, and XRP, according to THORChain’s network status page.

THORChain said node operators would re-enable chains only when they determine those environments are safe. The protocol framed the decision-making as conditional, indicating that resumption would not necessarily be immediate for every affected network.

Chainalysis: halt likely disrupted Binance-hack laundering

Beyond the protocol-level impact, the swap disruption had potential consequences for post-hack fund movement. Chainalysis said the emergency pause interfered with efforts by North Korean hackers to launder proceeds from last week’s $6.3 billion Binance hack.

“THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” Chainalysis said, adding that the pause is “preventing all users, including DPRK’s money launderers, from using cross-chain swaps.”

Chainalysis further stated that until the service returns online, neither hackers nor other users can swap through a majority of THORChain’s bridges. That matters because cross-chain swaps can be a critical step in turning stolen assets into different tokens or routing them away from confiscation targets.

Regulatory pressure and THORChain’s stance on permissionless swaps

The pause landed amid heightened attention from U.S. authorities on restricting the movement of stolen funds. On Saturday, the FBI urged THORChain node operators, DeFi services, and other virtual asset providers to block transactions associated with addresses used by “TraderTraitor” to launder proceeds from the Binance hack.

While the incident raised practical questions about how neutral infrastructure should respond under pressure, THORChain has continued to defend its model as permissionless settlement. Earlier, in its third-quarter report, the project said it maintained that stance despite scrutiny over stolen funds moving through the protocol.

THORChain founder John-Paul Thorbjornsen also addressed calls for shutdown or freezing behavior. In a public statement, he warned that taking the protocol offline would end the “experiment” and argued there would be no alternative venue for unencumbered settlement.

“IMO if THORNodes decided to take the protocol offline next week then the experiment is over,” Thorbjornsen said.

“The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed.”

What to watch next

As THORChain works to prevent refund mismatches tied to external-chain reorgs, market participants will likely focus on how quickly paused networks are re-enabled and whether the protocol can validate that the risk of nonce/reorg exploitation has been fully mitigated. For investigators and compliance-focused observers, the bigger question will be how incidents like this affect the timeline and feasibility of laundering attempts through cross-chain liquidity.